CVE-2023-51890 is an infinite loop in Mathtex 1.05 and earlier. A crafted string in the URL lets a remote attacker use up CPU. The record rates it High at 7.5. No fixed version is named, so limit access or remove the program.
What's affected
Mathtex 1.05 and earlier, a CGI program that renders LaTeX into images for web pages. The record gives no fixed version, and the write-up we read tests against 1.05 and earlier without naming a patched release. Check the project's current release and your package source.
Mathtex is distributed through CTAN and is often copied by hand into a server, so the copy you run may not match any release. Six CVEs were reported against it from one fuzzing session in December 2023, and all of them name 1.05 and earlier. The record for each lists the CTAN mathtex product with no version bound, so treat every version you find as in scope until the maintainers say otherwise.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is none, on integrity none, and on availability high. The weakness class is CWE-835.
How to check if you're exposed
Find out whether mathtex is installed. On a server, find / -name 'mathtex*' 2>/dev/null lists copies. A web server configuration that maps a cgi-bin path to mathtex.cgi also shows it. Then read the version in the source or documentation for your copy.
If the program is reachable from the internet, treat it as exposed. Most uses are old wiki or forum add-ons that nobody remembers.
Your dependency scanner will not see a copy of a CGI program dropped into a directory. A file system search, plus a review of web server configuration, is the dependable way to find it. You can also scan the application that embeds it with the free in-browser scan at https://gold.safeguard.sh/scan to catch the packaged components around it.
What to do now
- Find mathtex installs, including old wiki or forum add-ons.
- Check for a newer release, and update if one exists.
- Remove the program, or move math rendering to a maintained tool, if you cannot update.
- Do not expose it to the internet. Put it behind authentication or a reverse proxy that limits request size.
- Run it as an unprivileged account with no write access beyond its cache directory.
Why it matters
The weakness is a loop with an unreachable exit condition, CWE-835. Input makes the program spin forever.
Each such request ties up a process and a CPU core. A handful can slow a server for everyone else.
Process timeouts at the web server and per process CPU limits are good controls here.
Quick check
What does an attacker gain?
The ability to exhaust CPU, so a denial of service.
Is there a fix?
None is named.
Sources
Last reviewed: 19 October 2026.
